Publish and deploy the authenticated Murmur control plane

Build the committed Murmur control-plane image at `d3a53fb` for amd64, publish it to `cr.kaukus.no/kaukus/murmur-control-plane` with an immutable revision tag, pin the resulting digest in Ansible, and deploy PostgreSQL, Murmur and Caddy to the replacement control host. Constraints: - Do not use 1Password in this session. - Use the existing local Harbor credentials only through non-logging temporary handling; install pull credentials on the control host with Ansible `no_log` and remove temporary files. - Deploy by digest, not a mutable tag. - Keep GPU worker minimum at zero so deployment does not create GPU Instances. - Verify HTTPS, source restriction, JWT rejection behavior, container health and persisted state without submitting a transcription job. Acceptance criteria: - Registry artifact is labeled with source revision and available by immutable digest. - Ansible pins `cr.kaukus.no/kaukus/murmur-control-plane@sha256:…` and manages Harbor login securely. - PostgreSQL, control plane and Caddy are running; Caddy holds a trusted certificate for `murmur.kaukus.tv`. - HTTPS `/health` returns 204, HTTP redirects, unauthenticated `/v1/*` from the allowed Kaukus host reaches Murmur and returns 401, while other sources receive 403. - Port 8080 remains unpublished; no GPU worker is provisioned; deployment rerun is idempotent. Verified outcome: - Harbor image `cr.kaukus.no/kaukus/murmur-control-plane:d3a53fb` was published with source/revision/creation/version OCI labels and digest `sha256:71cea323318cf220d7e41a1273e0adc8c458743a32dbd806f8a5ca35fa7df0ce`. - Ansible pins that digest, authenticates to the private registry with a protected local extra-vars file and `no_log`, and keeps worker provisioning disabled pending a dedicated Scaleway identity. - PostgreSQL 18.3 is healthy; Murmur is running the pinned Harbor digest; Caddy is running its pinned digest with persistent certificate state. Port 8080 is internal-only and no GPU worker exists. - Let's Encrypt issued a certificate for `murmur.kaukus.tv` valid through 2027-01-12. HTTPS health returns 204 with the configured headers; HTTP returns 308 to HTTPS. - An outside source receives 403 for `/v1/*`; a request from the Kaukus production host reaches Murmur and receives its expected JWT 401 challenge. - Control-plane logs show the deliberate Scaleway-disabled state and no startup errors; the database contains no jobs. - A final Ansible rerun completed with zero changes.